# What is supplier assurance, and what do buyers check?

A useful supplier review checks the service you will use, the evidence behind it and what happens when things change.

The Assurance Desk. Published 8 October 2026. Last checked 8 October 2026.

Part of the guide [Customer security questionnaires: what they ask and how to answer](https://theassurancedesk.com/guides/customer-security-questionnaires-what-they-ask-and-how-to-answer.md).

**The short answer.** Supplier assurance means checking that a supplier can meet your requirements and keeps doing so. For cyber security, start with the risks the supplier brings to your business, then ask for evidence that matches those risks ([NCSC, Supplier assurance: having confidence in your suppliers](https://www.ncsc.gov.uk/blog-post/supplier-assurance-having-confidence-in-your-suppliers) and [NCSC, Supply chain security guidance, The principles of supply chain security, II. Establish control](https://www.ncsc.gov.uk/collection/supply-chain-security/principles-supply-chain-security/ii-establish-control), checked 8 October 2026).

## How much checking does a supplier need?

Start with what the supplier will do for you. How much would it matter if that service failed or the supplier caused a security problem? Use that answer to set realistic security requirements ([NCSC, Supplier assurance: having confidence in your suppliers](https://www.ncsc.gov.uk/blog-post/supplier-assurance-having-confidence-in-your-suppliers) and [NCSC, Supply chain security guidance, The principles of supply chain security, II. Establish control](https://www.ncsc.gov.uk/collection/supply-chain-security/principles-supply-chain-security/ii-establish-control), checked 8 October 2026).

This guide follows UK National Cyber Security Centre guidance, known as the NCSC. Its questions are a starting point for a conversation. The NCSC recommends that IT works with the business, buying team and security team ([NCSC, Supplier assurance: having confidence in your suppliers](https://www.ncsc.gov.uk/blog-post/supplier-assurance-having-confidence-in-your-suppliers), checked 8 October 2026).

**From business risk to useful evidence**

1. Understand the risk: What could go wrong with this supplier’s service?
2. Set the requirements: Choose security measures that match that risk.
3. Check the evidence: Look for support for the supplier’s answers.
4. Keep the conversation open: Review changes during the contract.

The depth of the review should follow the risk. This is a practical sequence, not a score or a promise that a supplier is secure.

Source: NCSC, Supplier assurance: having confidence in your suppliers, https://www.ncsc.gov.uk/blog-post/supplier-assurance-having-confidence-in-your-suppliers (checked 8 October 2026); NCSC, Supply chain security guidance, The principles of supply chain security, II. Establish control, https://www.ncsc.gov.uk/collection/supply-chain-security/principles-supply-chain-security/ii-establish-control (checked 8 October 2026); NCSC, How to assess and gain confidence in your supply chain cyber security, Stage 3: Apply the approach to new supplier relationships, Step 3: Monitor supplier security performance, https://www.ncsc.gov.uk/collection/assess-supply-chain-cyber-security/stage-3-apply-the-approach-to-new-supplier-relationships/step-3-monitor-supplier-security-perfomance (checked 8 October 2026)

## What do buyers check?

A useful review asks who does the work, what protects the service and what would happen if things went wrong. The table gives questions to adapt to the service you are buying ([NCSC, Supplier assurance questions](https://www.ncsc.gov.uk/guidance/supplier-assurance-questions), checked 8 October 2026).

**Supplier checks to build into your review**

| Area | Question to ask | Evidence to discuss |
| --- | --- | --- |
| Responsibility | Who owns cyber security here? | The people responsible and their roles. |
| Access | Who can reach the data and systems? | How staff access is limited to what their work needs. |
| Recovery | How would the service keep going after an incident? | The recovery plan and the service level it supports. |
| Testing | What has been tested, and what was fixed? | Independent test findings and the response to them. |
| Certification | Does the certificate cover this service? | Its scope, meaning the work and systems it covers. |
| Leaving | What happens to the data when the contract ends? | Terms for returning or securely deleting it. |

Source: NCSC, Supplier assurance questions, https://www.ncsc.gov.uk/guidance/supplier-assurance-questions (checked 8 October 2026)

## Is a certificate enough?

Check the scope before relying on a certificate. It needs to cover the part of the service you will use and the way you will use it. Then check the evidence for your other security requirements too ([NCSC, Supplier assurance questions](https://www.ncsc.gov.uk/guidance/supplier-assurance-questions) and [NCSC, Supply chain security guidance, The principles of supply chain security, II. Establish control](https://www.ncsc.gov.uk/collection/supply-chain-security/principles-supply-chain-security/ii-establish-control), checked 8 October 2026).

Put the agreed security requirements into the contract. The NCSC also says these requirements should reach any subcontractors involved ([NCSC, Supply chain security guidance, The principles of supply chain security, II. Establish control](https://www.ncsc.gov.uk/collection/supply-chain-security/principles-supply-chain-security/ii-establish-control), checked 8 October 2026).

> "A box ticking approach often leads to a false sense of cyber security."
> NCSC, Supplier assurance guidance
> NCSC, Supplier assurance: having confidence in your suppliers, https://www.ncsc.gov.uk/blog-post/supplier-assurance-having-confidence-in-your-suppliers (checked 8 October 2026)

## What happens after the contract is signed?

Keep talking to the supplier about changes. Regular reviews can cover security incidents and how the supplier manages accounts that can reach your systems or information ([NCSC, How to assess and gain confidence in your supply chain cyber security, Stage 3: Apply the approach to new supplier relationships, Step 3: Monitor supplier security performance](https://www.ncsc.gov.uk/collection/assess-supply-chain-cyber-security/stage-3-apply-the-approach-to-new-supplier-relationships/step-3-monitor-supplier-security-perfomance), checked 8 October 2026).

A monitoring tool can flag a change worth discussing. Treat that as a reason to ask questions. The NCSC cautions that such tools may not give a precise test of what a supplier can do ([NCSC, How to assess and gain confidence in your supply chain cyber security, Stage 3: Apply the approach to new supplier relationships, Step 3: Monitor supplier security performance](https://www.ncsc.gov.uk/collection/assess-supply-chain-cyber-security/stage-3-apply-the-approach-to-new-supplier-relationships/step-3-monitor-supplier-security-perfomance), checked 8 October 2026).

Check the exit arrangements before you need them. The contract should explain how your data will be returned or deleted when the work ends or moves to another supplier ([NCSC, Supplier assurance questions](https://www.ncsc.gov.uk/guidance/supplier-assurance-questions), checked 8 October 2026).

## What to do

1. Define the risks attached to the service before choosing the questions ([NCSC, Supplier assurance: having confidence in your suppliers](https://www.ncsc.gov.uk/blog-post/supplier-assurance-having-confidence-in-your-suppliers) and [NCSC, Supply chain security guidance, The principles of supply chain security, II. Establish control](https://www.ncsc.gov.uk/collection/supply-chain-security/principles-supply-chain-security/ii-establish-control), checked 8 October 2026).
2. Ask for evidence and check what it actually covers ([NCSC, Supplier assurance questions](https://www.ncsc.gov.uk/guidance/supplier-assurance-questions) and [NCSC, Supply chain security guidance, The principles of supply chain security, II. Establish control](https://www.ncsc.gov.uk/collection/supply-chain-security/principles-supply-chain-security/ii-establish-control), checked 8 October 2026).
3. Agree the contract requirements, then keep reviewing changes ([NCSC, Supply chain security guidance, The principles of supply chain security, II. Establish control](https://www.ncsc.gov.uk/collection/supply-chain-security/principles-supply-chain-security/ii-establish-control) and [NCSC, How to assess and gain confidence in your supply chain cyber security, Stage 3: Apply the approach to new supplier relationships, Step 3: Monitor supplier security performance](https://www.ncsc.gov.uk/collection/assess-supply-chain-cyber-security/stage-3-apply-the-approach-to-new-supplier-relationships/step-3-monitor-supplier-security-perfomance), checked 8 October 2026).

## Common questions

### Is supplier assurance just a questionnaire?

No. Questions help start the review, but buyers also need evidence and an ongoing conversation. Ticking boxes alone can give false confidence ([NCSC, Supplier assurance: having confidence in your suppliers](https://www.ncsc.gov.uk/blog-post/supplier-assurance-having-confidence-in-your-suppliers), [NCSC, Supply chain security guidance, The principles of supply chain security, II. Establish control](https://www.ncsc.gov.uk/collection/supply-chain-security/principles-supply-chain-security/ii-establish-control) and [NCSC, How to assess and gain confidence in your supply chain cyber security, Stage 3: Apply the approach to new supplier relationships, Step 3: Monitor supplier security performance](https://www.ncsc.gov.uk/collection/assess-supply-chain-cyber-security/stage-3-apply-the-approach-to-new-supplier-relationships/step-3-monitor-supplier-security-perfomance), checked 8 October 2026).

### Should every supplier face the same checks?

The checks should match the supplier’s importance and the risks to your business. Set requirements that are justified and realistic for that supplier ([NCSC, Supplier assurance: having confidence in your suppliers](https://www.ncsc.gov.uk/blog-post/supplier-assurance-having-confidence-in-your-suppliers) and [NCSC, Supply chain security guidance, The principles of supply chain security, II. Establish control](https://www.ncsc.gov.uk/collection/supply-chain-security/principles-supply-chain-security/ii-establish-control), checked 8 October 2026).

## Where next

- [Customer security questionnaires: what they ask and how to answer](https://theassurancedesk.com/guides/customer-security-questionnaires-what-they-ask-and-how-to-answer.md)
- [How do you check an ISO certificate is genuine?](https://theassurancedesk.com/guides/check-iso-certificate-is-genuine.md)
- [Article 28: what must a processor contract say?](https://theassurancedesk.com/guides/article-28-processor-contract.md)
- [How do you answer a security questionnaire without a certificate?](https://theassurancedesk.com/guides/security-questionnaire-without-certification.md)
- [The ISO 27000 family: which standard does what?](https://theassurancedesk.com/guides/iso-27000-family-explained.md)

## Sources

- NCSC, Supplier assurance: having confidence in your suppliers: https://www.ncsc.gov.uk/blog-post/supplier-assurance-having-confidence-in-your-suppliers (checked 8 October 2026)
- NCSC, Supply chain security guidance, The principles of supply chain security, II. Establish control: https://www.ncsc.gov.uk/collection/supply-chain-security/principles-supply-chain-security/ii-establish-control (checked 8 October 2026)
- NCSC, How to assess and gain confidence in your supply chain cyber security, Stage 3: Apply the approach to new supplier relationships, Step 3: Monitor supplier security performance: https://www.ncsc.gov.uk/collection/assess-supply-chain-cyber-security/stage-3-apply-the-approach-to-new-supplier-relationships/step-3-monitor-supplier-security-perfomance (checked 8 October 2026)
- NCSC, Supplier assurance questions: https://www.ncsc.gov.uk/guidance/supplier-assurance-questions (checked 8 October 2026)

---

**Who publishes this.** The Assurance Desk is published by Add-Venture Advisory Ltd, company number 11854524, registered in England and Wales. The same owner runs Avouch, a marketing agency that sells AI visibility services to firms of the kind this site covers. That is a conflict of interest, and it is disclosed here.